The following table provides a matrix of supported token type parameter and responses for Token Exchange.

| Identifier                                       | subject_token                                                | actor_token   | requested_token_type |
| ------------------------------------------------ | ------------------------------------------------------------ | ------------- | -------------------- |
| `urn:ietf:params:oauth:token-type:access_token`  | JWT or Opaque                                                | JWT or Opaque | Opaque only          |
| `urn:ietf:params:oauth:token-type:refresh_token` | Not allowed                                                  | Not allowed   | Not allowed          |
| `urn:ietf:params:oauth:token-type:id_token`      | Allowed                                                      | Allowed       | Allowed              |
| `urn:ietf:params:oauth:token-type:jwt`           | JWT signed by client, only in combination with `actor_token` | Not allowed   | Access Token as JWT  |
| `urn:zitadel:params:oauth:token-type:user_id`    | user ID as string, only in combination with `actor_token`    | Not allowed   | Not allowed          |
